The Hazard Analysis Critical Point (HACCP) concept involves a systematic approach to food safety based on hazard identification and control. The system is based on identifying and evaluating key steps in the food production chain which have the greatest impact on controlling the recognised hazards, but is often applied subjectively; ie HACCP is a quantitatively-based risk management system that currently relies on qualitative risk evaluation. This paper explores ways to resolve this apparent anomaly, including the emerging concept of 'quantitative microbial risk assessment', using an imaginary scenario involving Listeria monocytogenes in a ready-to-eat food.